@bongos/core 1.19.790 → 1.19.791

package/modules/hall-ui/public/hall-visual.js

@@ -0,0 +1,85 @@
+// modules/hall-ui/public/hall-visual.js — the ship-time task visual, in one place
+// (task 1003835; the renderers themselves are tasks 1003109 and 1003829).
+//
+// A satellite of hall-kit.js rather than a part of it, and that is the decision
+// this file records. These three functions lived in the kit, which is 61KB of
+// pager/ledger/filter/chart machinery. The task record page (task.html) renders a
+// visual and needs NOTHING else the kit holds, so converging it onto the kit's
+// renderer would have meant loading 61KB on the hall's most-visited record page
+// for one function — a real cost, paid on the wrong page. The alternative was to
+// let task.js keep its own copy, which is how the hall ended up with two.
+//
+// So the helpers moved OUT. Any page that renders a visual loads this file; the
+// kit no longer carries them and the pages that only use the kit no longer pay
+// for them. The owner's call (2026-09-16) was that the kit may grow satellites
+// like this one.
+//
+// Contract, identical to the kit's own: dependency-free (its own esc(), no
+// window.OTB use) so load order only needs "before the page script";
+// node-require-safe, so tests/task_visuals.mjs can require it with no DOM;
+// string-template builders returning HTML, no state, no render loop.
+//
+// CSS: each caller supplies its own BEM base, because SIZE is the surface's
+// decision and not this file's — the task record caps at 52vh in a record column
+// (.tk-visual, style.css/task.css), the Studio gives the plate the card's whole
+// width (.studio-plate). The markup, the URL guard and the escaping are shared.
+(() => {
+  'use strict';
+
+  // HTML-escape for text interpolated into innerHTML.
+  function esc(s) {
+    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
+      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+    }[c]));
+  }
+
+  // Same-origin, SERVER-MINTED paths only. The URL arrives from our own API, but
+  // it lands in an href and a src, so it is matched literally against the shape
+  // modules/lifecycle/task-visuals.js mints rather than trusted. Anything else
+  // renders nothing at all.
+  const VISUAL_URL_RE = /^\/api\/(gds|bongos)\/task-visuals\/task-\d+-[0-9a-f]{16}\.(png|jpg|gif|webp)$/;
+  function isTaskVisualUrl(url) {
+    return VISUAL_URL_RE.test(String(url ?? ''));
+  }
+
+  // The compact thumbnail, for a FEED — where the summary is one line in a list,
+  // so the image appears small and links to the full-size file. Three feeds draw
+  // it (the hall's ship ledger, a profile's recent ships, the status dashboard).
+  // Returns '' when the row carries no visual: a task without one must never look
+  // incomplete, so nothing is drawn and there is no placeholder.
+  function shipVisualThumbHtml(row) {
+    const url = String((row && row.visual_url) ?? '');
+    if (!isTaskVisualUrl(url)) return '';
+    const alt = String((row && row.visual_alt) || `Visual for task ${(row && row.id) ?? ''}`).trim();
+    return `<a href="${esc(url)}" target="_blank" rel="noopener" title="${esc(alt)}">` +
+      `<img class="ship-visual-thumb" src="${esc(url)}" alt="${esc(alt)}" loading="lazy"></a>`;
+  }
+
+  // The FULL-SIZE form: the picture as the thing being looked at, with visual_alt
+  // as its caption. For a surface whose subject IS the image — the task record
+  // (.tk-visual) and the Studio's review card (.studio-plate).
+  //
+  // `className` is the caller's BEM base; it is sanitised because it reaches a
+  // class attribute. Returns '' with no visual, like the thumbnail.
+  function taskVisualFigureHtml(row, { className = 'task-visual' } = {}) {
+    const url = String((row && row.visual_url) ?? '');
+    if (!isTaskVisualUrl(url)) return '';
+    const written = String((row && row.visual_alt) || '').trim();
+    const alt = written || `Visual for task ${(row && row.id) ?? ''}`;
+    const base = String(className).replace(/[^A-Za-z0-9_-]/g, '');
+    // The caption is only drawn when the shipper WROTE one — the fallback alt is
+    // a machine sentence for a screen reader, not a caption to show a reader.
+    const caption = written ? `<figcaption class="${base}__caption">${esc(written)}</figcaption>` : '';
+    return `<figure class="${base}">` +
+      `<a href="${esc(url)}" target="_blank" rel="noopener">` +
+      `<img class="${base}__img" src="${esc(url)}" alt="${esc(alt)}" loading="lazy">` +
+      `</a>${caption}</figure>`;
+  }
+
+  const api = { isTaskVisualUrl, shipVisualThumbHtml, taskVisualFigureHtml };
+
+  // Node-require-safe (the dom-utils.js / hall-kit.js pattern): assignment is the
+  // only eval-time side effect, and only when a window exists.
+  if (typeof window !== 'undefined') window.OTBVisual = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/index.html

@@ -110,6 +110,7 @@
 <script src="/builders/box-panel.js?v=2026-06-14-domutils" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.
      Loaded BEFORE hall-widgets.js, whose skeletons call OTBKit.pagerBarHtml(). -->
+<script src="/builders/hall-visual.js?v=2026-09-16-visual1" defer></script>
 <script src="/builders/hall-kit.js" defer></script>
 <!-- BV1.R75: the CORE hall widgets register into window.OTB's hall-widget registry.
      Loaded BEFORE builders.js so the registry is populated when builders.js stamps

package/modules/hall-ui/public/profile.html

@@ -196,6 +196,7 @@
 <!-- hall-kit (window.OTBKit) — profile.js renders ship-time task visuals through
      its shared thumbnail helper (task 1003109) and builds the section rail with
      it (task 1003489), so it must load first. -->
+<script src="/builders/hall-visual.js?v=2026-09-16-visual1"></script>
 <script src="/builders/hall-kit.js?v=2026-08-27-activity"></script>
 <!-- Connections (section 6). Loaded BEFORE profile.js so window.OTBConnections
      exists by the time renderProfile runs; profile.js guards on it anyway, so a

package/modules/hall-ui/public/profile.js

@@ -176,7 +176,7 @@
     const summary = s.value_summary
       ? `<span style="display:block;margin-top:2px;font-size:12px;color:var(--ink-faint)">${escapeHtml(s.value_summary)}</span>`
       : '';
-    const visual = window.OTBKit && window.OTBKit.shipVisualThumbHtml ? window.OTBKit.shipVisualThumbHtml(s) : '';
+    const visual = window.OTBVisual ? window.OTBVisual.shipVisualThumbHtml(s) : '';
     return `<tr>
         <td class="ledger__num">#${escapeHtml(String(s.id))}</td>
         <td><a href="${taskHref(s.id)}">${escapeHtml(s.title || `Task ${s.id}`)}</a>${summary}${visual ? `<span style="display:block;margin-top:6px">${visual}</span>` : ''}</td>
@@ -473,7 +473,7 @@
         const summary = t.value_summary
           ? `<span style="display:block;margin-top:2px;font-size:12px;color:var(--ink-faint)">${escapeHtml(t.value_summary)}</span>`
           : '';
-        const visual = kit.shipVisualThumbHtml ? kit.shipVisualThumbHtml(t) : '';
+        const visual = window.OTBVisual ? window.OTBVisual.shipVisualThumbHtml(t) : '';
         return `<tr>
           <td class="ledger__num">#${escapeHtml(String(t.id))}</td>
           <td><a href="${taskHref(t.id)}">${escapeHtml(t.title || `Task ${t.id}`)}</a>${summary}${visual ? `<span style="display:block;margin-top:6px">${visual}</span>` : ''}</td>

package/modules/hall-ui/public/studio.css

@@ -155,7 +155,7 @@
    IS the card: an artist is being asked to LOOK at something, so it is given the
    card's full width and as much height as a screen can spare, not the 44px
    thumbnail a ship feed uses. Markup comes from the kit's one renderer
-   (OTBKit.taskVisualFigureHtml); only the size is this room's decision.
+   (OTBVisual.taskVisualFigureHtml); only the size is this room's decision.
 
    max-height in vh, and MEASURED at 1440x900 rather than chosen. The size an
    artist can judge it at wins over a zero-scroll card — that is the task's own

package/modules/hall-ui/public/studio.html

@@ -72,6 +72,7 @@
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure
      (task 1003829). The copy desk — the artist's other room — already loads it,
      and a fourth hand-rolled <figure> is what the kit exists to stop. -->
+<script src="/builders/hall-visual.js?v=2026-09-16-visual1"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/studio.js?v=2026-09-10-studio2"></script>
 </body>

package/modules/hall-ui/public/studio.js

@@ -132,7 +132,7 @@
   // ---------------------------------------------------------------------------
 
   // THE PLATE — the reviewed work's ship-time visual, at the size the card can
-  // give it. Through the kit's one renderer (OTBKit.taskVisualFigureHtml, which
+  // give it. Through the one renderer (OTBVisual.taskVisualFigureHtml, which
   // carries the server-minted-URL guard and the escaping) with the Studio's own
   // class, because the size is this surface's decision: here the picture is the
   // subject, not an illustration beside a record.
@@ -141,8 +141,9 @@
   // read, or when the kit is absent — a review with no picture must read as a
   // review, never as an empty frame (the degrade rule).
   function plateHtml(p) {
-    if (!p.shipped || !kit || typeof kit.taskVisualFigureHtml !== 'function') return '';
-    return kit.taskVisualFigureHtml(p.shipped, { className: 'studio-plate' });
+    const vis = window.OTBVisual;
+    if (!p.shipped || !vis || typeof vis.taskVisualFigureHtml !== 'function') return '';
+    return vis.taskVisualFigureHtml(p.shipped, { className: 'studio-plate' });
   }
 
   // The three weights, and the one field they share. Offered only to a viewer

package/modules/hall-ui/public/style.css

@@ -2841,22 +2841,6 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   overflow-y: auto;
 }
 .td-touches { font-size: 12.5px; color: var(--ink-faint); font-family: var(--font-mono); word-break: break-word; margin: 0 0 12px; }
-/* task 1003109: the ship-time VISUAL, rendered directly under the value summary
-   it restates. Sized to be READ (this exists so a non-engineer can see a change),
-   capped so a tall screenshot can't push the rest of the record off the page, and
-   never drawn at all when a task has no visual. */
-.td-visual { margin: 0 0 12px; }
-.td-visual__img {
-  display: block;
-  max-width: 100%;
-  max-height: 52vh;
-  width: auto;
-  height: auto;
-  border: var(--line) solid var(--rule-soft);
-  border-radius: var(--radius-sm);
-  background: var(--glass);
-}
-.td-visual__caption { font-size: 12.5px; color: var(--ink-faint); margin: 6px 0 0; }
 /* The compact form: a thumbnail beside a value summary in a ship FEED, where the
    summary is one line in a list and a full-width image would drown it. */
 .ship-visual-thumb {

package/modules/hall-ui/public/task.html

@@ -68,6 +68,7 @@
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail2" defer></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/md-reader.js" defer></script>
+<script src="/builders/hall-visual.js?v=2026-09-16-visual1" defer></script>
 <script src="/builders/task.js?v=2026-07-03-taskpage1" defer></script>
 </body>
 </html>

package/modules/hall-ui/public/task.js

@@ -292,20 +292,17 @@
   // a detail can be opened full-size. The caption (visual_alt) doubles as the alt
   // text, which is why it is stored: an image with no alt tells a screen reader
   // nothing, and "a picture of the change" is exactly the audience that needs it.
+  // The shared renderer (hall-visual.js), not a copy of it — task 1003835. This
+  // page hand-rolled the same <figure> until then; the markup it produced is what
+  // OTBVisual emits, so .tk-visual's rules are unchanged. `className` keeps the
+  // sizing this page's own CSS owns (52vh inside a record column).
+  //
+  // Guarded rather than assumed: hall-visual.js is a separate <script>, so a page
+  // that forgot it should render no picture, never a broken one.
   function taskVisualHtml(t) {
-    const url = String(t.visual_url || '');
-    // Same-origin, server-generated paths only. The URL comes from our own API,
-    // but rendering it into an href/src is a place to be literal rather than
-    // trusting: anything that is not the shape our serve route mints is dropped.
-    if (!/^\/api\/(gds|bongos)\/task-visuals\/task-\d+-[0-9a-f]{16}\.(png|jpg|gif|webp)$/.test(url)) return '';
-    const alt = String(t.visual_alt || `Visual for task ${t.id}`);
-    const caption = t.visual_alt
-      ? `<figcaption class="tk-visual__caption">${escapeHtml(t.visual_alt)}</figcaption>`
-      : '';
-    return `<figure class="tk-visual">` +
-      `<a href="${escapeHtml(url)}" target="_blank" rel="noopener">` +
-      `<img class="tk-visual__img" src="${escapeHtml(url)}" alt="${escapeHtml(alt)}" loading="lazy">` +
-      `</a>${caption}</figure>`;
+    const vis = window.OTBVisual;
+    if (!vis || typeof vis.taskVisualFigureHtml !== 'function') return '';
+    return vis.taskVisualFigureHtml(t, { className: 'tk-visual' });
   }
 
   async function copyText(text) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.790",
+  "version": "1.19.791",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.790",
+      "version": "1.19.791",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.790",
+  "version": "1.19.791",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/accessibility-replay.js

@@ -0,0 +1,195 @@
+// scripts/gds/accessibility-replay.js — the two-profile replay regression for the
+// accessibility dimension (task 1002517; clauses 5 and 8 of criterion
+// `accessibility-fluency-profile`, which named this run as its OWN proof).
+//
+// WHAT IT PROVES, and why it is not already covered.
+// tests/session_accessibility.mjs pins the scorer's contracts against synthetic
+// fixtures it builds itself — a test of the arithmetic. It cannot answer the
+// criterion's actual question, which is about PROSE: does the dimension reward a
+// reply a newcomer can use, and does it leave an expert's reply alone? So this
+// harness takes a FIXED set of eight questions a newcomer really asks, each the
+// documented trigger of a surface that exists, answered twice — once in each
+// register — and scores both runs.
+//
+// Four legs. Each one fails a different way of being wrong:
+//
+//   1. FLOOR          the non-technical run, under the non-technical profile,
+//                     clears FLOOR. The dimension recognises accessible prose.
+//   2. NO PENALTY     the engineer run, under the engineer profile, is not
+//                     scored at all — every signal waived, score null.
+//   3. DISCRIMINATION the SAME engineer prose under the NON-TECHNICAL profile
+//                     falls BELOW FLOOR, with every detector registering hits.
+//                     Without this leg 1 proves nothing — a scorer that returned
+//                     10 for everything, or three detectors that had gone blind,
+//                     would pass leg 1 and look identical to a working one.
+//   4. LENGTH         `doubleRun` says the same prose twice. Chars double, hits
+//                     double, the rate is unchanged, so the score must be
+//                     IDENTICAL. That is the metric reading density rather than
+//                     volume, asserted against real prose.
+//
+// WHERE TERSENESS PROTECTION ACTUALLY COMES FROM, since the task's "watch out"
+// is a metric that punishes an expert's brevity. It is leg 2 — the WAIVER — not
+// the per-1000-character rates. The rates make the score independent of how long
+// an answer is at a fixed density (leg 4); they do NOT make it independent of
+// density, and they should not: three undefined terms in three hundred
+// characters really is denser than three in three thousand. What protects the
+// expert is that their profile removes those two signals from the scoring set
+// entirely. `terseVariant` — every turn cut to its first sentence, a genuinely
+// shorter and thinner answer — is checked too, asserting only that answering
+// more briefly never COSTS points; it is a guard, not the mechanism.
+//
+// One honest asymmetry this surfaced and the corpus now records: under
+// `technical_level: engineer` with `toolchain_familiarity: new`, the engineer
+// run still scores, because terminal-where-a-click-path-exists is waived by the
+// TOOLCHAIN setting, not the technical one. "I think in code" and "I live in a
+// terminal" are two different answers, and the scorer is right to keep them
+// apart. tests/accessibility_replay.mjs pins that pairing so a future widening
+// of the engineer waiver has to be a deliberate edit.
+//
+// The corpus is data — tests/fixtures/accessibility-replay.json — so adding a
+// prompt is an edit to JSON, not to code.
+//
+// Run:  node scripts/gds/accessibility-replay.js
+//       node scripts/gds/accessibility-replay.js --json
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { scoreAccessibility, bandFor } = require('../../modules/sessions/accessibility.js');
+
+const CORPUS_PATH = path.join(__dirname, '..', '..', 'tests', 'fixtures', 'accessibility-replay.json');
+
+// FLOOR — the score a non-technical run has to clear. It is bandFor()'s
+// 'workable' boundary and deliberately not a second independent number: the
+// scorer already draws the line between prose a newcomer can work with and prose
+// that is merely dense, and inventing a different one here would let the two
+// drift. tests/accessibility_replay.mjs asserts they stay tied.
+const FLOOR = 6.0;
+
+function loadCorpus(file = CORPUS_PATH) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+// terseVariant — each turn cut to its first sentence: a shorter, thinner answer.
+// Mechanical on purpose. A hand-written "terse version" in the corpus would be a
+// version tuned until it passed; taking the first sentence of prose written for
+// another purpose is a variant nobody got to tune.
+function terseVariant(turns) {
+  return turns.map((t) => {
+    const m = /^[^.!?]*[.!?]/.exec(t);
+    return m ? m[0] : t;
+  });
+}
+
+// doubleRun — the same prose said twice. Every count doubles and so does the
+// character total, so every rate is unchanged and the score must come back
+// EXACTLY equal. This is the length-independence property at prose altitude: a
+// scorer that had drifted to absolute counts would double its penalties here.
+function doubleRun(turns) {
+  return [...turns, ...turns];
+}
+
+// asDetail — a run's replies as the per-turn digest shape scoreAccessibility
+// reads. The user turns are included because a real digest has them and
+// assistantProse must keep ignoring them; if it ever stopped, the prompts would
+// start scoring the builder's own words and every number here would move.
+function asDetail(corpus, replies, { transform } = {}) {
+  const detail = [];
+  let i = 0;
+  for (const { id, prompt } of corpus.prompts) {
+    detail.push({ i: i++, role: 'user', snippet: prompt });
+    const turns = replies[id] || [];
+    for (const snippet of transform ? transform(turns) : turns) {
+      detail.push({ i: i++, role: 'assistant', snippet });
+    }
+  }
+  return detail;
+}
+
+const TRANSFORMS = { terse: terseVariant, doubled: doubleRun };
+
+// replay — score one named run under one profile. `profile` defaults to the
+// run's own declared profile, which is the pairing the criterion asks about;
+// passing another is how leg 3 reads engineer prose as a newcomer would.
+function replay(corpus, runName, { profile, variant } = {}) {
+  const run = corpus.runs[runName];
+  if (!run) throw new Error(`no such run in the corpus: ${runName}`);
+  const transform = variant ? TRANSFORMS[variant] : undefined;
+  if (variant && !transform) throw new Error(`no such variant: ${variant}`);
+  const effective = profile || run.profile;
+  const result = scoreAccessibility(asDetail(corpus, run.replies, { transform }), { profile: effective });
+  return { run: runName, variant: variant || 'full', profile: effective, result };
+}
+
+// The partial engineer profile — thinks in code, new to the toolchain. Named
+// here because it is the pairing that shows the two waivers are independent.
+const ENGINEER_NEW_TO_TOOLCHAIN = Object.freeze({ technical_level: 'engineer', toolchain_familiarity: 'new' });
+
+function rows(corpus) {
+  const newcomer = corpus.runs.non_technical.profile;
+  return [
+    ['non-technical prose, non-technical profile', replay(corpus, 'non_technical')],
+    ['engineer prose, engineer profile', replay(corpus, 'engineer')],
+    ['engineer prose, NON-TECHNICAL profile', replay(corpus, 'engineer', { profile: newcomer })],
+    ['engineer prose, engineer but new to the terminal', replay(corpus, 'engineer', { profile: ENGINEER_NEW_TO_TOOLCHAIN })],
+    ['non-technical prose, said twice', replay(corpus, 'non_technical', { variant: 'doubled' })],
+    ['non-technical prose, first sentences only', replay(corpus, 'non_technical', { variant: 'terse' })],
+  ];
+}
+
+function fmt(n) {
+  return n == null ? '—' : n.toFixed(1);
+}
+
+function formatReport(corpus) {
+  const lines = [`accessibility replay — ${corpus.prompts.length} fixed beginner prompts, floor ${FLOOR.toFixed(1)}`, ''];
+  for (const [label, r] of rows(corpus)) {
+    const { score, band, sampled_chars: chars, sampled_turns: turns } = r.result;
+    const waived = r.result.signals.filter((s) => s.waived).length;
+    lines.push(
+      `  ${label.padEnd(48)} ${fmt(score).padStart(5)}  ${band.padEnd(9)} ` +
+        `${String(turns).padStart(3)} turns  ${String(chars).padStart(5)} chars  ${waived}/3 waived`
+    );
+    for (const s of r.result.signals) {
+      if (s.waived) continue;
+      if (!s.count) continue;
+      lines.push(
+        `      ${s.type.padEnd(28)} ${String(s.count).padStart(2)} hits  rate ${s.rate.toFixed(2)}/1k  −${s.penalty.toFixed(2)}`
+      );
+    }
+  }
+  return lines.join('\n');
+}
+
+// main — the CLI. `write` is injectable so the test can exercise both output
+// paths without printing a screenful of JSON into the test log.
+function main(argv = process.argv.slice(2), write = (s) => process.stdout.write(s)) {
+  const corpus = loadCorpus();
+  if (argv.includes('--json')) {
+    const out = { floor: FLOOR };
+    for (const [label, r] of rows(corpus)) out[label] = r.result;
+    write(`${JSON.stringify(out, null, 2)}\n`);
+    return 0;
+  }
+  write(`${formatReport(corpus)}\n`);
+  return 0;
+}
+
+module.exports = {
+  FLOOR,
+  CORPUS_PATH,
+  ENGINEER_NEW_TO_TOOLCHAIN,
+  loadCorpus,
+  terseVariant,
+  doubleRun,
+  asDetail,
+  replay,
+  rows,
+  formatReport,
+  bandFor,
+  main,
+};
+
+if (require.main === module) process.exit(main());

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.790'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.791'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');